Resolvido.
Inseri mais algumas opções no arquivo que gera a response final no server e funcionou.
Segui a sugestão de https://stackoverflow.com/questions/43622368/save-token-that-comes-in-response-to-api
it looks that you did not expose the header correctly, the browser
will not forward this header to your code unless you specify it server
side.
try adding this this to you $headers object
$response->headers->set('Access-Control-Allow-Methods', 'POST, GET, OPTIONS, PUT, DELETE');
$response->headers->set('Access-Control-Allow-Headers', 'Content-Type, X-Auth-Token, Origin, Authorization');
$response->headers->set('Access-Control-Expose-Headers', 'Authorization');
$response->headers->set('Authorization', 'Bearer ' . $newToken);
return $response;